Method and system for predicting victim users and detecting fake user accounts in online social networks

Abstract

A system and method for predicting victims and detecting fake accounts in OSNs, comprising: a feature-based classifier for predicting victims by classifying, with a classification probability, a target variable of each user in the OSN social graph; a graph-transformer for transforming the social graph into a defense graph by reassigning edge weights to incorporate victim predictions using the classification probability, a graph-based detector for detecting fake users by computing through the power iteration method a probability of a random walk to land on each node in the defense graph after 0(log n) steps, assigning to each node a rank value equal to a node's landing probability normalized by the node degree, sorting the nodes by their rank value and estimating a detection threshold such that each node whose rank value is smaller than the detection threshold is flagged as representing a fake account.

Description

FIELD OF THE INVENTION[0001]The present invention has its application within the telecommunication sector, and especially, relates to Online Social Networking (OSN) services, such as Facebook, Twitter, Digg, LinkedIn, Google+, Tuenti, etc., and their security mechanisms against attacks originating from automated fake user accounts (i.e., Sybil attacks).BACKGROUND OF THE INVENTION[0002]Traditionally, the Sybil attack in computer security represents the situation wherein a reputation system is subverted by forging identities in peer-to-peer networks through creating a large number of pseudonymous identities and then using them to gain a disproportionately large influence. In an electronic network environment, particularly in Online Social Networks (OSNs), Sybil attacks are commonplace due to the open nature of these networks, where an attacker creates multiple fake, each called a Sybil node, and pretends to be multiple real users in the OSN.[0003]Attackers can create fake accounts in ...

AI Technical Summary

Benefits of technology

[0080]The present invention enables proactive mitigation of attacks originating from fake accounts in OSNs by predicting potential victims who are likely to share relationships with fake accounts. This means OSNs can now help potential victims avoid falling prey to automated social engineering attacks, where the attacker tricks users into accepting his connection requests, by applying one of the known proactive user-specific abuse mitigation techniques, e.g., the aforementioned Facebook Immune System (FIS). For example, potential victims can reject connecting with possibly fake user accounts if they are better informed through privacy “nudges”, which represent warnings that communicate the implications of a security or privacy-related decision (e.g., by informing users that connecting with strangers means they can see their pictures). By displaying these warnings to only potential victims, the OSN avoids annoying all other users, which is an important property as user-facing tools tend to introduce undesired friction and usability inconvenience.

[0081]The present invention enables retroactive graph-based detection that is effective in the real world, which is achieved by incorporating victim predictions into the calculation of user ranks. This means that OSNs can now deploy effective graph-based detection that can withstand a larger number of fake relationships and accounts, and still deliver higher detection performance with desirable, provable security guarantees.

[0082]The present invention employs efficient methods to predict potential victims and detect fake accounts in OSNs, which in total take 0(n·log n+m) time, where n is the number of nodes and m is the number of edges in the social graph. This makes the present invention suitable for large OSNs consisting of hundreds of millions of users.

Problems solved by technology

Feature-based detection technique is efficient but does not provide any provable security guarantees.

This way, nodes with rank values close to zero are considered suspicious and represent isolated, fake accounts.

As a result, graph-based detection generally suffers from bad ranking quality, and therefore, low detection performance, rendering it impractical for real-world deployments, including for example multi-community scenarios.

Images